CVE-2008-1448

2008-08-1300:41:00

CWE-264

[email protected]

web.nvd.nist.gov

cve-2008-1448

microsoft outlook express

windows mail

mhtml

protocol handler

cross-domain information disclosure

vulnerability

7.1 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:C/I:N/A:N

6.2 Medium

AI Score

Confidence

Low

0.926 High

EPSS

Percentile

99.0%

JSON

The MHTML protocol handler in a component of Microsoft Outlook Express 5.5 SP2 and 6 through SP1, and Windows Mail, does not assign the correct Internet Explorer Security Zone to UNC share pathnames, which allows remote attackers to bypass intended access restrictions and read arbitrary files via an mhtml: URI in conjunction with a redirection, aka “URL Parsing Cross-Domain Information Disclosure Vulnerability.”

Affected configurations

NVD

Node

microsoftoutlook_expressMatch5.5sp2

microsoftoutlook_expressMatch6.0

microsoftoutlook_expressMatch6.0sp1

microsoftwindows_mail

CPENameOperatorVersion
microsoft:outlook_expressmicrosoft outlook expresseq5.5
microsoft:outlook_expressmicrosoft outlook expresseq6.0
microsoft:windows_mailmicrosoft windows maileq*

CPE	Name	Operator	Version
microsoft:outlook_express	microsoft outlook express	eq	5.5
microsoft:outlook_express	microsoft outlook express	eq	6.0
microsoft:windows_mail	microsoft windows mail	eq	*